...
Tool | Version | Checker | Description | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| CodeSonar |
| IO.INJ.FMT | Format string injection | ||||||||||||
| Compass/ROSE | |||||||||||||||
| Coverity |
| TAINTED_STRING | Implemented | ||||||||||||
| GCC |
| Can detect violations of this rule when the | |||||||||||||
| Klocwork |
| ||||||||||||||
| LDRA tool suite |
| 86 D | Partially Implemented | ||||||||||||
| Parasoft C/C++test |
| SECURITY-05 SECURITY-08 SECURITY-36 | |||||||||||||
| Polyspace Bug Finder | R2016a | Tainted string format | Input format argument is from an unsecure source | ||||||||||||
| PVS-Studio | 6.22 | V618 | |||||||||||||
| Splint |
| PVS-Studio | 6.22 | V618 | General analysis rule |
Related Vulnerabilities
Two examples of format-string vulnerabilities resulting from a violation of this rule include Ettercap and Samba.
...